EUVD-2026-84807
GHSA-p7gw-vm7r-23mp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network unauth (AV:N/PR:N/UI:N) and full RCE impact, but AC:H because a specific non-default, non-secure configuration must be present for the target to be vulnerable.
Primary rating from Vendor (SolarWinds).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.
AnalysisAI
Unauthenticated remote code execution affects SolarWinds Observability Self-Hosted installations that are running in a non-default and non-secure configuration, allowing an attacker who can reach the service to execute arbitrary code with no credentials and no user interaction. The root cause is insufficient integrity checking (CWE-345): when the insecure configuration is present, integrity validation that would otherwise block attacker-supplied content is weakened or bypassed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the SolarWinds Observability Self-Hosted installation to be running in a non-default AND non-secure configuration - the vulnerability does NOT affect default/hardened deployments per the vendor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) presents this as a textbook critical unauthenticated network RCE, but this score is materially misleading because the description explicitly limits impact to 'installations configured in a non-default and non-secure configuration.' That environmental gate is not reflected in the base metrics and sharply reduces the real-world exposed population - only operators who have deviated from SolarWinds' documented secure configuration are affected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade SolarWinds Observability Self-Hosted to 2026.2.3, the release documented in the HCO 2026.2.3 release notes (https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-2-3_release_notes.htm) as referenced by the advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28324. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every SolarWinds Observability Self-Hosted installation and determine which ones do not match the vendor's documented secure-configuration baseline; for any that deviate, restrict reachability at the network layer so only trusted management networks, VPN segments, or jump hosts can contact the service, and disable or firewall any internet-facing listener. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Observability Self Hosted
View allUnauthenticated remote code execution in SolarWinds Observability Self-Hosted (CVSS 8.8) allows attackers on an adjacent
Stored/reflected cross-site scripting (XSS) vulnerability in SolarWinds Observability Self-Hosted caused by insufficient
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sani
Open redirect in SolarWinds Observability Self-Hosted enables an authenticated low-privilege attacker on an adjacent net
Authenticated SQL injection in SolarWinds Observability Self-Hosted allows an attacker holding a low-privilege account t
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. Rated medium severity (CVSS 4.
SolarWinds Observability Self-Hosted XSS Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is low atta
Share
External POC / Exploit Code
Leaving vuln.today